Log filtering before indexing

[NeharikaVats]

I want to filter the palo logs at the forwarder level by looking at the packet before indexing (licensing) based certain condition like... zone, firewall name (enterprise) etc

The logs come to both our UF & HF, what is the best way to achieve it.

Was looking into a few docs suggesting to apply ingest eval, is that feasible?

Can anyone please help me with this.

[gcusello]

Hi @NeharikaVats ,

you can filter your logs before indexing following the instructions at https://docs.splunk.com/Documentation/Splunk/9.1.1/Forwarding/Routeandfilterdatad#Filter_event_data_...

You have to apply these configurations in the first Heavy Forwarder you have in your infrastructure.

Ciao.

Giuseppe

[ITWhisperer]

You need to direct the "unwanted" events to a nullqueue